The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md file contains installation instructions that involve downloading and executing shell scripts directly from a remote server using risky patterns.
Evidence: The command bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)" and the PowerShell equivalent irm https://cua.ai/driver/install.ps1 | iex are suggested for installation.
[COMMAND_EXECUTION]: The skill's primary function is to execute the cua-driver CLI tool and various shell commands to automate GUI interactions, manage processes, and perform environment diagnostics.
Evidence: The documentation across SKILL.md, MACOS.md, WINDOWS.md, and LINUX.md describes extensive use of shell commands and the cua-driver binary to operate the system.
[INDIRECT_PROMPT_INJECTION]: The skill operates by reading accessibility trees and web page content, which are untrusted data sources that could contain hidden instructions intended to hijack the agent's logic.
Ingestion points: Data enters the agent context through tools like get_window_state (UI trees) and get_browser_state (DOM content).
Boundary markers: No explicit delimiters or instructions to ignore embedded data are present in the provided instructions.
Capability inventory: The skill has broad capabilities, including process execution, file system interaction (via apps), and network navigation.
Sanitization: No evidence of sanitization or filtering of the ingested UI/DOM data was observed.
[PRIVILEGE_ESCALATION]: Documentation in EMBEDDING.md describes techniques for the driver to inherit macOS TCC permissions (Accessibility and Screen Recording) from a host process via the responsibility chain. On Windows, it manages scheduled tasks for persistence and describes handling different integrity levels.
Evidence: Detailed instructions on macOS responsibility chain inheritance and Windows autostart configuration via scheduled tasks.

cua-driver